Add per-subsystem config validation for wireguard, authelia, nftables, tunnel

- wireguard: ValidateConfig checks ListenPort range, Address/LanCIDR CIDR
  format. SaveConfig now validates before writing.
- authelia: ValidateConfigOpts checks required fields (Domain, JWTSecret,
  SessionSecret) and StorageEncKey minimum length (20 chars). GenerateConfig
  now validates before generating.
- nftables: ValidateWANInterface checks interface exists via net.InterfaceByName
  before generating rules that reference it.
- tunnel: ValidateConfig checks TunnelID, PublicDomain, GatewayDomain are set
  and credentials file exists. WriteConfig now validates before generating.

internal/nftables/manager.go

@@ -3,6 +3,7 @@ package nftables
 import (
 	"fmt"
 	"log/slog"
+	"net"
 	"os"
 	"os/exec"
 	"strings"
@@ -131,6 +132,18 @@ func (m *Manager) ValidateRules(rulesPath string) error {
 	return nil
 }
 
+// ValidateWANInterface checks that the specified WAN interface exists on the system.
+// Returns nil if empty (no WAN filtering) or if the interface exists.
+func ValidateWANInterface(name string) error {
+	if name == "" {
+		return nil
+	}
+	if _, err := net.InterfaceByName(name); err != nil {
+		return fmt.Errorf("WAN interface %q not found: %w", name, err)
+	}
+	return nil
+}
+
 // SafeApply validates, backs up, writes, and applies nftables rules.
 // On apply failure, rolls back to the previous rules.
 func (m *Manager) SafeApply(content string) error {